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Thank you to the Chair and Members for inviting me to this session. | am the 
UK’s Information Commissioner - in that role | am the supervisory authority for 
data protection law in the UK. My office which is known as the ICO, is, | believe, 
the largest data protection authority in the EU by staff numbers and funding. We 
are a proactive supervisory authority, with an educational and investigative role 
beyond adjudicating on data protection complaints. Specifically, in relation to the 
subject of this hearing, my office, is leading the investigation into the 
Facebook/Cambridge Analytica case, on behalf of our EU counterparts. Some 
other EU Data Protection Authorities have active investigations into a number of 


different concerns relating to Facebook. 


| am joined today by my Deputy Commissioner J ames Dipple-J onnstone, who 
leads the operations side of my office and has taken a leading role in our 


investigation into the use of data analytics for political purposes. 


We are appearing here today during an ongoing formal investigation. Therefore, 


there are limits to what we can say today. That may include responding to 
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comments made by the other panellists. | am happy to respond in more detail to 


the committee in writing when | am able to disclose further information. 


But first, | want to assure you and the public who may be watching - | 
understand your unease about how online platforms, including Facebook, are 
using our personal data and who they may be sharing it with. More recently we 
have seen that the behavioural advertising ecosystem has been applied across to 
political campaigning to influence how we vote. | am deeply concerned that this 
has happened without due legal or ethical consideration of the impacts to our 


democratic system. 


That’s not to say that the online space is unregulated. Whenever online activities 
use personal data then data protection law applies and can provide effective 
protection for individuals. Data protection is a fundamental right in the EU 
Charter and CJ EU case law, has made clear that online platforms are data 
controllers under data protection law. They can be held fully liable for their 


misuse of personal data. 


These organisations have control over what happens with an individual’s personal 
data and how it is used to filter content - they control what we see, the order in 
which we see it, and the algorithms that are used to determine this. Online 


platforms can no longer say that they are merely a platform for content; they 
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must take responsibility for the provenance of the information that is provided to 


users. 


But | recognise that some aspects of our legal systems have failed to keep up 
with the unforeseen pace of the internet’s development. In terms of data 
protection law, the GDPR is an important step forward for the law and data 
protection supervisory authorities to catch up. The GDPR is written flexibly to 
ensure that supervisory authorities like the ICO have the capacity to ‘follow the 
data’ and establish who a data controller is, regardless of the medium in which 


personal data is processed. 


Data protection law, and the reach of a data protection supervisory authority, 
extends well beyond brick and mortar office premises. Data crimes are real 
crimes. GDPR fully equips us to thoroughly investigate crimes that may have 


taken place entirely online. 


As some of you may be aware, it was in May 2017 that | announced a formal 
investigation, explaining my concerns about invisible processing - the ‘behind the 
scenes’ algorithms, analysis, data matching and profiling involving personal data 


- that had taken place in political and referendum campaigning. 


In February 2018, our focus on Facebook and Cambridge Analytica, one strand of 
the investigation, was heightened by evidence provided by Mr Wylie, who you will 


hear from shortly. It is against a backdrop of intense media and political interest 
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that the ICO has continued its investigation. I’ve also given evidence to the UK 


parliamentary committee investigating fake news, chaired by Damian Collins MP. 


We currently have a twin track approach: 


to investigate specific allegations and conclude any enforcement actions. 


- to produce a report about the wider implications of our investigation, 
including recommendations about gaps in regulation, both data protection and 


otherwise. We plan to publish this report before the end of this month. 


Our investigation is significant and wide ranging - we have over 40 of our own 
investigators full time on the enquiry plus external legal and forensic IT recovery 
experts. This probably adds a further 20 or so staff. We are looking at over 30 
separate organisations and the actions of around a dozen key individuals. We are 
investigating social media platforms, data brokers, analytics firms, political 
parties and campaign groups and academic institutions. We are looking at both 
regulatory and criminal breaches. We are working with other regulators, EU Data 


protection authorities and law enforcement in the UK and abroad. 


Our work needs to meet the civil and criminal standards of evidence gathering 
and recovery if it is to be useful. We have recovered materials, including seizing 
dozens of servers containing, in total, hundreds of terabytes of data, from 
searches of several premises and dozens of interviews. We have used the full 


range of our powers, including formal notices to require information to be 
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provided, our powers of entry under warrant, as well as our audits and inspection 


powers. 


We are looking at the complete range of sanctions at our disposal at this time 
including our new powers under the new UK Data Protection Act for no-notice 
inspections, quicker warrants, to compel delivery of evidence and to seal digital 


evidence where it cannot be immediately recovered. 


The spotlight is well and truly on data protection and | recognise the important 
task the ICO has underway. This is a vital opportunity to assure citizens across 
the EU that where their personal data is misused there is an effective regulatory 


response to help protect them. 


So, where do we go from here? The issues raised by the Facebook/Cambridge 
Analytica case go beyond the remit of the ICO as the data protection authority 
investigating the case. We will make recommendations in our upcoming report, 


the relevance of which will extend beyond the borders of the UK. 


Beyond data protection, | expect my report will be relevant to other regulators 
overseeing electoral process and academic research. What is clear is that work 
will need to be done to strengthen information sharing and closer working across 


these areas. 


But my main message for MEPs is to give the GDPR some time to operate. This 


investigation by the ICO is unprecedented in its scale - we believe it is the 
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largest investigation ever undertaken by a data protection authority. The 


investigation is providing an early opportunity to consider the GDPR against the 


pressures and demands of a real world contemporary case. 


Our investigation and action in this case will change the behaviour and 
compliance of all of the actors in the political campaigning space. J ournalists, 
whistle blowers, advocates and parliamentarians have played a key role in 


bringing these issues to public attention. 


We now need sustained willingness by citizens to exercise their data protection 
rights. We need data protection authorities unafraid to use our new tools, 
sanctions and fining powers. And we need legislators supporting their data 
protection authorities to ensure they have the capacity and capability to deliver 


their important role. 


I am happy to participate and answer questions; but | would ask the committee 
to consider that | am in the middle of a significant criminal investigation that 
goes wider than Cambridge Analytica and Facebook. This may constrain areas 
on which | am able to comment. We are happy to inform the committees of this 


house at later stages of any developments if that would be helpful. 


Thank you. 


